NumberFormat Exception no clue to as why (resolved)


(Ed) #1

Need some help with figuring out why this is an issue.

I Was noticing some of my requests are getting dropped by the logstash-output-elasticsearch

So I took a HTTP Dump of the and is seems my "process.root" is being detected as a "Number but I don't get why it is a problem as my mappings never specify the root field

Here is the

  • post request,
  • The results
  • and the mappings

Post request

POST /_bulk   HTTP/1.1
Content-Length: 1379
Content-Type: text/plain;charset=ISO-8859-1
Host: localhost: 9200
Connection: Keep-Alive
User-Agent: Manticore0.4.1
Accept-Encoding: gzip,
deflate{
    "index": {
        "_id": null,
        "_index": "proc-pidstats-2015.07.06",
        "_type": "pidstats",
        "_routing": null
    }
}{
    "file": "/proc",
    "host": "coperdragon",
    "type": "pidstats",
    "process": {
        "cmdline": "/lib/systemd/systemd --user",
        "cwd": "/",
        "environ": {
            "LANG": "en_US.UTF-8",
            "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
            "NOTIFY_SOCKET": "/run/systemd/notify",
            "HOME": "/home/eperry",
            "LOGNAME": "eperry",
            "USER": "eperry",
            "SHELL": "/bin/bash",
            "XDG_RUNTIME_DIR": "/run/user/1000"
        },
        "exe": "/lib/systemd/systemd",
        "fd": [
            
        ],
        "root": "/",
        "nlwp": 1,
        "io": {
            "rchar": 126250,
            "wchar": 89,
            "syscr": 380,
            "syscw": 14,
            "read_bytes": 12288,
            "write_bytes": 0,
            "cancelled_write_bytes": 0
        },
        "pid": 969,
        "comm": "systemd",
        "state": "S",
        "ppid": 1,
        "pgrp": 969,
        "session": 969,
        "tty_nr": 0,
        "tpgid": -1,
        "flags": 4202752,
        "minflt": 708,
        "cminflt": 28,
        "majflt": 0,
        "cmajflt": 0,
        "utime": 0,
        "stime": 0,
        "cutime": 0,
        "cstime": 0,
        "priority": 20,
        "nice": 0,
        "itrealvalue": 0,
        "starttime": 4598,
        "vsize": 43773952,
        "rss": 1144,
        "rlim": "18446744073709551615",
        "startcode": 140676395724800,
        "endcode": 140676397013836,
        "startstack": 140730179294528,
        "kstkesp": 140730179291560,
        "kstkeip": 140676388357331,
        "signal": 0,
        "blocked": 671173123,
        "sigignore": 4096,
        "sigcatch": 0,
        "wchan": "18446744071581185509",
        "nswap": 0,
        "cnswap": 0,
        "exit_signal": 17,
        "processor": 2,
        "rt_priority": 0,
        "policy": 0,
        "name": "systemd",
        "uid": 1000,
        "euid": 1000,
        "gid": 1000,
        "egid": 1000
    },
    "@version": "1",
    "@timestamp": "2015-07-06T21:36:09.811Z"
}

Response

HTTP/1.1  200  OK
Content-Type: application/json;charset=UTF-8
Content-Length: 267

{
    "took": 1,
    "errors": true,
    "items": [
        {
            "create": {
                "_index": "proc-pidstats-2015.07.06",
                "_type": "pidstats",
                "_id": "AU5lTDVUNEZxVejXPVEr",
                "status": 400,
                "error": "MapperParsingException[failed to parse [process.root]]; nested: NumberFormatException[For input string: \"/\"]; "
            }
        }
    ]
}

Mappings

{
"logstash": {
"order": 0,
"template": "logstash-*",
"settings": {
"index.refresh_interval": "5s"
},
"mappings": {
"_default_": {
"dynamic_templates": [
{
"message_field": {
"mapping": {
"index": "analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "message"
}
}
,
{
"string_fields": {
"mapping": {
"index": "analyzed",
"omit_norms": true,
"type": "string",
"fields": {
"raw": {
"index": "not_analyzed",
"ignore_above": 256,
"type": "string"
}
}
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"properties": {
"geoip": {
"dynamic": true,
"properties": {
"location": {
"type": "geo_point"
}
},
"type": "object"
},
"@version": {
"index": "not_analyzed",
"type": "string"
}
},
"_all": {
"enabled": true,
"omit_norms": true
}
}
},
"aliases": { }
},
"output-es-template": {
"order": 0,
"template": "proc-*",
"settings": {
"index.refresh_interval": "30s"
},
"mappings": {
"_default_": {
"dynamic_templates": [
{
"message_field": {
"mapping": {
"index": "not_analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "message"
}
}
,
{
"string_fields": {
"mapping": {
"index": "not_analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"properties": {
"@version": {
"index": "not_analyzed",
"type": "string"
}
},
"_all": {
"enabled": true,
"omit_norms": true
}
}
},
"aliases": { }
}
}

(Ed) #2

Never mind, it was old data in the index because of an exception


(system) #3